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Abstract 

The hidden subgroup problem (HSP) provides a unified framework to study problems of group- 
theoretical nature in quantum computing such as order finding and the discrete logarithm problem. While 
it is known that Fourier sampling provides an efficient solution in the abelian case, not much is known for 
general non-abelian groups. Recently, some authors raised the question as to whether post-processing 
the Fourier spectrum by measuring in a random orthonormal basis helps for solving the HSP. Several 
negative results on the shortcomings of this random strong method are known. In this paper however, 
we show that the random strong method can be quite powerful under certain conditions on the group G. 
We define a parameter r(G) for a group G and show that 0((log \G\/r(G)) 2 ) iterations of the random 
strong method give enough classical information to identify a hidden subgroup in G. We illustrate the 
power of the random strong method via a concrete example of the HSP over finite Heisenberg groups. 
We show that r(G) — £7(1) for these groups; hence the HSP can be solved using polynomially many 
random strong Fourier samplings followed by a possibly exponential classical post-processing without 
further queries. The quantum part of our algorithm consists of a polynomial computation followed 
by measuring in a random orthonormal basis. This gives the first example of a group where random 
representation bases do help in solving the HSP and for which no explicit representation bases are known 
that solve the problem with (log G)°^ Fourier samplings. As an interesting by-product of our work, we 
get an algorithm for solving the state identification problem for a set of nearly orthogonal pure quantum 
states. 

1 Introduction 

The hidden subgroup problem (HSP) is defined as follows: We are given a function / : G — > S from a 
group G to a set S with the promise that there exists a subgroup H < G such that / is constant on the left 
cosets of H and takes distinct vàlues on distinct cosets. In this paper, all groups and sets are finite and all 
vector spaces are finite dimensional over C. The function / is given via a black box, i. e., given i £ Gas 
input, the black box outputs f(x). The task is to find a set of generators for H while making as few queries 
to / as possible. We would also like our algorithm to be efficient in terms of total running time. The abelian 
HSP (i. e. G is abelian) encompasses several interesting problems such as finding the order of an element in 
a group and the discrete logarithm problem. Factoring an integer n can be reduced to order finding in the 
group Z* , the multiplicative group of integers modulo n which are coprime to n. The problems of graph 
isomorphism and graph automorphism can be cast as hidden subgroup problems over the non-abelian group 
S n , the group of permutations on n symbols. 
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The classical query complexity of the HSP is IGj^ 1 ) which is exponential in the input size log \G\. 
This is true for many families of groups including several families of abelian groups. The biggest success 
of quantum algorithms so far has been a polynomial time (both query complexity as well as total running 
time) solution for the abelian HSP IKit95l lBH97IIME98l . The heart of this solution is Fourier sampling with 
respect to the abelian group G. 

In sharp contrast to the abelian HSP, progress on the non-abelian HSP (i. e. G is non-abelian) has so 
far been qui te limited. Ettinger, H0yer and Knill [EHK04] prové that the quantum query complexity of 
the non-abelian HSP is 0(log \G\); however, their algorithm takes 2°( log l G D quantum operations. Ivanyos 
et al. [IMS03| and Friedl et al. [FIM+03] apply abelian Fourier transform methods to give polynomial 
quantum algorithms for the HSP for some special classes of non-abelian groups. Given the success of 
Fourier sampling in solving the abelian HSP, one can similarly ask whether Fourier sampling over the non- 
abelian group G helps in solving the HSP over G. The Fourier transform over a (in general, non-abelian) 
group G gives us a superposition over (p, i,j) where p is an irreducible unitary representation of G and i,j 
are the row and column indices of the matrix p. The choice of basis for p gives us a degree of freedom 
in defining the Fourier transform over G. This is in contrast to the abelian case, where all representations 
are one-dimensional and hence only their names p matter. The algorthim starts out with a tensor product of 
t = 0(log \ G\) superposi tions over random cosets of the hidden subgroup H. Exploiting the symmetries 
in these states, one can show that (see e.g. |Kup03| |Ip03| IMRS05I ) the optimal measurement to recover 
H consists of applying the Fourier transform to each coset state, measuring the names of the t irreducible 
representations, followed by a joint POVM on the column spaces of the resulting t states. In strong Fourier 
sampling, one measures each of the t column spaces using an orthonormal basis, i. e., one performs a tensor 
product of t complete von Neumann measurements instead of a joint POVM. In weak Fourier sampling, one 
measures the names of the t representations only. 

Hallgren, Russell and Ta-Shma [ HRTS03 1 showed that polynomially many iterations of weak Fourier 
sampling give enough information to reconstruct normal hidden subgroups. More generally, they show 
that the normal core c(H) of the hidden subgroup H (i. e. the largest normal subgroup of G contained 
in H) can be reconstructed via the weak method. Grigni, Schulman, Vazirani and Vazirani [GSVV04] 
and Gavinsky [Gav04| extended the weak method to íind a hidden subgroup H in G if [G : n{G)H] = 
(loglGI)^ 1 ). Here, k(G) is the Baer subgroup of G defined as n{G) = f] K . K<G N(K), where N{K) 
denotes the normaliser of K in G. The main shortcoming of the weak method is that it gives exactly the 
same probability distribution if the hidden subgroup is H or a conjugate gHg^ 1 of H. This leads us to 
consider the strong method. The amount of additional information about the hidden subgroup H that can be 
extracted by measuring the column space in an orthonormal basis depends, in general, on the particular basis. 
In a recent paper, Moore, Russell and Schulman [MRS05 1 showed that for the symmetric group S n , for any 
choice of bases for the representations, there are order two subgroups that require exponential number of 
strong Fourier samplings in order to distinguish them from the identity subgroup. Grigni et al. [GSVV04] 
study the random strong method where a random measurement basis is used for each representation p. They 
define a group-theoretic parameter a depending on G and H and show that if a is exponentially large, 
the additional advantage of the random strong method over the weak method is exponentially small. In 
particular, this is case when G = S n and H < S n , \H\ = 2°( nlo s n ). 

1.1 Our contributions 

In this paper, we analyse the power of the random strong method and show, for the fïrst time, that under 
certain (different) general conditions on G polynomially many iterations of the random strong method do 
give enough classical information to identify H. We illustrate the power of the random strong method via a 
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concrete example of the HSP over finite Heisenberg groups Ti p of order p 3 , where p > 3 is a prime. Ti p is 
defined as the following set of upper triangular matrices: 



TLp :- 





fi 


X 






{l 





1 


y 


: sc,y,£ G F p | 
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A convenient encoding for the elements of Ti p is to write [x, y, z), where x,y,z G F p match the components 
in equation (Q. The composition of two elements is then given by 

(xi,yi,zi) o (x 2 ,y 2 ,z 2 ) = {x\ +x 2 ,yi + y2,zi + z 2 +xiy 2 ), 

and the inverse of an element is given by (se, y, = (—se, —y, xy — z). It is easy to see that the classical 
randomised query complexity of the HSP on Tí p is 0(p). The genèric quantum algorithm of Ettinger, H0yer 
and Knill [EHK04] achieves O(logp) query complexity, but at the expense of p°^°sp) quantum operations. 
An algorithm with 2 e ^ logp ^ quantum operations can be obtained by combining the ideas of [Kup03| and 



[FIM + 03 1. However, the query complexity of this algorithm is also 2 e ^ logp \ It seems non-trivial to design 
a quantum algorithm with (logp)°^ query complexity and total running time p°^. In the following 
paragraphs, we indicate how various existing methods for non-abelian HSP fail to achieve this goal. After 
that, we show how the random strong method attains this goal, illustrating the power of random bases in 
Fourier sampling. 

It can be shown that 7í p is a semidirect product of the form Z p x (Z p x Z p ), where the normal subgroup 
is given by A r DO := {(0, y, z) : y,z G F p } and the complement by Aq^q := {(se, 0,0) : x G F p }. The 
commutator subgroup of 7í p is given by [Tt p , 7í p ] = {(0, 0, z) : z G F p }, which is also the centre C,{TL P ). 
The commutator subgroup is isomorphic to Z p ; hence it is abelian but not smoothly abelian (an abelian group 
G is said to be smoothly abelian [FIM+03] if it is the direct product of a subgroup of bounded exponent and 
a subgroup of size (log jG)) ^). The Baer subgroup turns out to be k(H p ) = C,{Tí p ). If A < H p , \A\ = p, 
then \k(TI p )A\ < p 2 ; therefore for such an A, [G : k(7í p )A] > p. In fact, we will see later that there are 
(p 2 + p + 1) order p subgroups of H p . Thus, the methods of I GS VV04I lGav04l IIMS031 lFIM+031 are not 
applicable in order to solve the HSP for TL P efficienfly. For more details about the Heisenberg group, see 
Section|2| 

The chief obstacle to finding hidden subgroups in TL P arises from the order p subgroups of Tí p other 
than its centre. There are {p 2 + p) such order p subgroups; we shall call them Aíj, i G ¥ p U {oo}, j G F p . 
The forgetful abelian method (i. e. Fourier sampling over the abelian group 7L p x (Z p x Z p ) instead of 
the non-abelian group TL P = Z p x (Z p x Z p )), weak Fourier sampling, strong Fourier sampling in the 
natural representation basis of TL p (i. e. the representation basis adapted to the distinguised subgroup tower 
{ 1} <d iVoo < Típ) as well as strong Fourier sampling in the Z p -Fourier transform of the natural representation 
basis give exponentially small information about the index i of Ai j. For more details, see Section l2l4l For 
now, we give an intuitive description of the main difficulty posed by these subgroups. Suppose the hidden 
subgroup is Aíj for some i G F p U {oo}, j G F p . With exponentially high probability, Fourier sampling 
over Típ gives us a representation uniformly at random from one of the (p — 1) irreducible representations 
of degree p for k = 1, . . . ,p — 1 of Tí p . Suppose one such representation shows up. The state essentially 
col·lapses to a vector \ipk,i,j) € C p , i. e., (Tí p , Aíj) is a Gelfand pair for all i,j (see also [MR05 1 for Gelfand 
pairs in the context of the HSP). The vectors \ipk,i,j) have the property that 

{4= : i ^ i', for all j, f, 
ójj : i = i, 
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i. e., they form a set of (p + 1) mutually unbiased bases [WF89| of C p . The main difficulty is that it is not 
clear a priori that there is any orthonormal basis that can pairwise distinguish between these (p 2 +p) vectors 
with inverse polynomial probability. Note that the so-called hidden conjugate problem \ MRRS04 1 is easy 
to solve information-theoretically for Tt p ; the conjugacy classes of the order p subgroups are defined by i 
and the above property says that {\ipk,ij)}j is an orthonormal basis of C p , so given the conjugacy class i 
one can measure in this orthonormal basis to determine the actual hidden subgroup Aíj. In view of this, the 
main challenge in solving the HSP for Tí p is to identify the conjugacy class i. 

In this paper however, we show that a random representation basis for pk does in fact pairwise distinguish 
between \ipk,i,j) w i tn constant probability. In fact, we refine the method of random measurement bases to 
distinguish between families of nearly orthogonal subspaces. We combine the geomètric ideas of random 
measurement bases together with representation-theoretic techniques to obtain a parameter r(G; Hi, H2) of 
a group G and subgroups H\,H2 < G. We show that r(G; H\, H2) is a lower bound on the total variation 
distance between the distributions on pairs (p, j) of representation names and column indices obtained by 
the random strong method for candidate hidden subgroups H\, H2. The parameter r(G; H\, H2) is defined 
in terms of the ranks and overlaps of the projectors obtained by averaging representations p over H\,H2. 
Denne r(G) := min^ : h 2 r {G; üi, -í/2), where H\, H2 range over all pairs of subgroups of G. We show 
that O ( ^°^2 S (q^ ^ iterations of the random strong method give sufficient classical information to identify the 

hidden subgroup H, where s(G) denotes the number of distinct subgroups of G. Note that s(G) < 2 log2 ' G l 
for any group G. 

We will see later in Section|2]fhat s(Ti p ) = 0(p 2 ). In Section|4] we show that r(7í p ) = 0(1), implying 
that O(logp) iterations of the random strong method give sufficient information to extract the hidden sub- 
group mTíp. This gives us an algorithm solving the HSP over 7í p with O(logp) query complexity, 0(log 3 p) 
quantum operations for implementing the non-abelian Fourier transforms (see Section l23l . 0{p 2 ) quantum 
operations to measure in a random basis, and 0(p 4 ) classical post-processing operations. This gives the first 
example of a group where random representation bases do help in solving the HSP and for which no explicit 
representation bases are known that solve the problem with (logp)°^ Fourier samplings. 

As an interesting by-product of our work, we get an algorithm for solving the following quantum state 
Identification problem: Consider a set of pure quantum states {\ipi),. . . , \ip m )} € C n with the property that 
< 5 for all i / j, where 5 is a sufficiently small constant (and typically m S> ri). We are given 
t independent copies of \ipi). The task is to identify the index i. We show that t = O(logm) independent 
random complete von Neumann measurements in C n suffice to identify i with high probability. 



1.2 Relation to other work 

Moore, Rockmore, Russell and Schulman [MRRS04| use non-abelian strong Fourier sampling to give an 
efficient algorithm for the HSP over the g-hedral group 7L q x Z p when p, q are prime, q \ (p — 1) and 
(p — ï)/q = (logp) ^. Our techniques show that for p, q prime, q \ (p — 1), q = Çl(y/p), r(Z q x Z p ) = 
0(1), which proves that polynomially many random strong Fourier samplings suffice to find an arbitrary 
hidden subroup of Z g K Z p in this case. For prime p, q \ (p — 1), q = 0(p 3 / 4 ), subgroups H\, H2 conjugate 

to Z ç < Z p _i, our techniques show that r(Z p _i x Z p ; R\, H 2 ) = O ( y^) ■ Moore et ai - IMRRS04I prové 

a nearly matching upper bound of r(Z p _i x Z p ; H\, H2) = O (y/| logp^ . Thus, a polynomial amount of 
random strong Fourier sampling can solve the hidden conjugate problem for subgroup Z ç < Z p _i of the 
affine group Z p _i x Z p if and only if p/q = (\ogp)°^. 

In this paper, we confine ourselves to random strong Fourier sampling. Our quantum operations always 
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factor into a tensor product over the coset states obtained by querying the function oracle. This distinguishes 
the Heisenberg group from the symmetric group for which Moore, Russell and Schulman [MRS05| show 
that tensor product Fourier sampling is not sufncient to solve the HSR The quantum part of our algorithm 
consists of a polynomial computation followed by measuring in a random orthonormal basis. In fact, if a 
suitable kind of pseudo-random unitary transformation can be generated and implemented efflciently, then 
the quantum part of the algorithm can be made fully polynomial. Various notions of pseudo-random unitary 
transformations have been studied (see e.g. [EWS + 03, Eme04|), but it has to be investigated whether they 
are sufficient for our purposes. 

2 Heisenberg groups over ¥ p 

The groups Tí p , where p > 3 is prime, are discrete versions of the continuous Heisenberg groups studied in 
physics in the context of conjugate observables. Abstractly, Tí p is isomorphic to the following group given 
in terms of generators and relations: Tí p = (x, y,z:x p = y p = z p = l,xy = zyx, xz = zx, zy = yz). 

2.1 The subgroup lattice 

Since the order of TL P is p 3 we can expect to fmd subgroups of order p and p 2 besides the trivial subgroup 
{1} and Típ. The centre of Ti p is given by 

an p ) = ((0,0,1)} = {(0,0, z) :zG¥ p }. 

Note that \({Tí p )\ = p. There are p + 1 subgroups iVj of order p 2 , where i G ¥ p U {oo}. They are given by 

Ni : = ((1, i, 0), (0,0,1)) ={(x,xi,z) :x,ze¥ p }, \fi G F p . 

The group is given by := ((0, 1,0), (0, 0, 1) = {(0, y,z) : y,z G ¥ p }; Z p x Z p . It is 

easy to see that for all i G ¥ p U {oo}, ((Tí p ) < Ni. Furthermore the Ni are normal subgroups, JV» < Tí p 
and Ni = 7, p x Z p . For each i G ¥ p U {oo}, we have that Ni contains p subgroups Aíj for j G ¥ p . The 
subgroups Ai j satisfy | Aíj \ = p, whence Aíj = 7L V . For i,j G ¥ p we have the following explicit desciption 
of the elements of Aíj. 

Aíj := (0M,i)) = {(fJ,,fJ,i, í^ji + ^j) ■ V G F p }. 



For i = oo, j G F p we obtain Ax>,j := ((0, 1, j)) = {(0, /i, /ij) : /u G F p }. It is easy to see that Aíj iVj/ 
ifi^i', and the normaliser is given by iV^ (^4íj ) = Ni. The above groups form a complete list of distinct 
subgroups of Tip. The following table summarizes the subgroup structure of Ti p . 



Size 


Subgroup 


Number 


Containment 


P 3 


Típ 


1 




P 2 


Ni, i G FpU {oo} 


p+1 


Ni < Típ 


P 


C(TC p ),Aij,i GFpU{oo},j G Fp 


p 2 + p + 1 


Aíj < JV if C(Wp) < A^fe, Vfc G Fp U {oo} 


1 


{1} 


1 


{1} < ((Hp), {1} < Ajj 



For i, i' G Fp U {oo} where i ^ i' we have that iV^ n iV»/ = ((Tí p ). This shows that k(Tí p ) = 
V\k-k<H N{K) = ({Típ). Also, it is easy to check that the commutator subgroup is given by [Tí p , Tí p ] = 

a-Hp): p 
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2.2 The irreducible representations of H p 

Since we want to perform Fourier analysis on the groups TL P we have to determine the irreducible repre- 
sentations of Hp. The reader not familiar with the Standard notations of representation theory is referred 
to Standard references like [CR621 or ISer77l . Observe that U p = A ,o X = Z p k (Z p x Z p ). This 
semidirect product structure can be used to construct the irreducible representations of Tí p . First, there are 
p 2 one-dimensional representations Xa,b for a, b G F p which come from the factor group TL P / Ci^rip) = Zp. 
In the following, let lo denote a fixed pth root of unity in the complex numbers. Then the one-dimensional 
irreducible representations of 7í p are given by 

Xa,b((x,y,z)) :=u; ax+b y a,be¥ p . 

Let F* denote the group of non-zero elements of ¥ p under multiplication. There are p— 1 irreducible rep- 
resentations pk, fe G F* of degree p. They are obtained in the following way: Take a nontrivial character of 
the centre ((H p ), extend it to the abelian group iVoo, and induce it to TL P . Explicitly, we obtain the following 
representations: For each fe G F*, we have a nontrivial character <pk of (,{Tip) given by (j>k((0, 0, z)) := ui kz . 
Since C(^p) <1 ^oo and is abelian, we can extend 4>k to a character <p k of iVoo by simply defining 
fc ((O, y, 0)) := 1. We choose the elements of Aq : q as transversals for in 7í p . Then p k is defined to 
be the induction p k := (f) k |a o Up- On the generators of 7í p , we find that p k takes the following vàlues: 
^((1,0,0)) = J2 ae¥p \a)(a + l|, PJfe ((0,l,0)) = £ a6Fp u ka \a){a\ and p k ((0, 0, 1)) = u%, where l p 
denotes the identity operator in C p . Since (x, y, z) = (0, 0, z)(0, y, 0)(x, 0, 0) for all x,y,z G F p , we obtain 
that 

Pk {{x,y,z)) =tü kz uj kya \a)(a + x\. 
oeFp 

It can be readily checked that the x a ,6> f° r a, G F p and p k , for fe G F* form a complete set of inequivalent 
irreducible representations of H p . 

2.3 Ranks and overlaps of various projectors 

Deíine Pk-ij '■= ^ SoeA» ■ Pk( a )- It * s easv to see that * s an orthogonal projection operator. In 

order to calculate the parameter r{TL p ) (see Section|4]for the details of the calculation) we have to compute 
the ranks of Pk-ij and pairwise overlaps \\Pk-,i,jPk;ï (the reason for the nomenclature of overlap will 
be made clear in Section ITIT) . For i,j G ¥ p , we obtain by a straightforward computation that P k -,i,j = 

l Tt^ueFp^p^ 1 ^ Hence, P k . id = \i>k;i,j) (^k;ijl where 

Wk,ij) = 4= E uT*«»>' +w V>, i, j G F p , fe G F;. 



In the case i = oo, j G F p , we get Pfc ;o o,j = |'0fc;oo,j)(V , ifc;oo,i|, where \ipk;oo,j) = \ ~ j) j G fe G F*. 
Thus for all fe G F*, i G F p U {oo}, j G F p , rank(Pfc.jj) = 1 and Pk-i,j is an orthogonal projection onto 
\Í>k;i,j)- For G F p , weget \\Pk; 00 ,jPk;oo,j'\\ = For i, i',/ G ¥ p , we get ||Pfe ; ijPfe;ooj'|| = For 
G Fp, we get 

iiíVjíwii = i<feife')i = - E ^((^(-o+mü-/)). 

To evaluate the last term above, we need the following fact about quadratic Weil sums in ¥ p . 
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Fact 1 (| 



Theorem 5.37]) Let h(X) G be a degree two polynomial. Then, 



xev„ 



By Fact [D if i ^ i', \(tpk;i,j\^k;i' ,f)\ 



i', it is easy to see that 



-j= irrespective of j and f. If i 
I (ipk·,i,j\' l l :i k·i' j') I = ^ü'- To summarise, we have shown the following result: 

Lemma 1 Suppose p is an odd prime. Let i, i' £ F P U {°o}, j,f G F p aní/ Aíj,Aí>ji be two order p 
subgroups ofTCp other than the centre (,(7i p ). Let pk, where k G F* be an irreducible representation of 
Tip of degree p. Let Pk;i,j be defined by Pk;i,j '■= \ XlaeA; 3 Pk{ a ) an d let Pk-i'j' be defined similarly. Then 
Pk;i,j> Pk;i',j' ore rank one orthogonal projections, and their overlap is given by 



| Pk;i,j Pk:i' ,j' 



-jp ■ i/í far all ', 
6 jtj , : i = ï. 



Thus, for any k G F*, the vectors \tpk;i',j') form a set of (p + 1) mutually unbiased bases for C p . 



2.4 Failure of existing methods to solve the HSP over H p 

A straightforward classical randomised algorithm for the HSP over Tí p is as follows: Query / : H v — > S at 
0{p) random elements of Tí p . If we do not find a\, a,2 G 7í p , a\ / a,2 such that /(ai) = f(a,2), we declare 
{1} to be the HSP of /. Suppose we do find such a pair a%, ü2- Then there is a unique order p subgroup A 
of Típ such that a^[ 1 a2 G A. f can now be thought of as a function on H p /A. Query / at 0( A /p) random 
elements of Tí p /A. If we do not find 61,62 G Tí p /A, b\ ^ 62 such that /(61) = 7(62), we declare A to be 
the HSP of /. Suppose we do find such a pair 61, 62. Let B = (A, 6^ 1 &2). If \B\ = p 3 , declare the HSP to 
be Tip. If \B\ = p 2 , query / at an element c G Tí p , c B. If /(c) = f(B), declare the HSP to be TL P , else 
declare the HSP to be B. The correctness of the algorithm follows from the subgroup structure of Tí p and 
the birthday paradox. A matching lower bound of Q(p) for classical randomised algorithms can be proved 
using the subgroup structure of Tí p and Yao's minimax principle. 

Suppose the HSP is Aíj, for some i G F*, j G ¥ p . It can be shown (see Section EOl for details) 
that Fourier sampling gives a p-dimensional representation with probability 1 — i, and each p-dimensional 
representation has equal probability to show up. Suppose one such representation pk, k G F* shows up. The 
natural representation basis \a), a G F p is the basis |V ; fc;oo,j)> where j G ¥ p . The 7L V -Fourier transform of 
the natural representation basis is the basis |V>fc;0,j)> where j G ¥ p . By LemmafJ the probability distribution 
obtained by measuring the columns of pk in the natural representation basis or in the Z p -Fourier transform of 
the natural representation basis is the uniform distribution. This shows that weak Fourier sampling, strong 
Fourier sampling in the natural representation basis of Tí p as well as strong Fourier sampling in the Z p - 
Fourier transform of the natural representation basis give exponentially small information about the index i 
of A i:j . 

Recali that Tí p = ^4o,o * -^00 = Z p x (Z p x Z p ). Suppose we try to perform Fourier sampling over the 
abelian group Aq : q x = Z p x Z p x Z p (the forgetful abelian method) instead of the non-abelian group 
Típ. Let F denote the Fourier transform over Z p x Z p x Z p , i. e., 

F = p~ 3 / 2 uj ax+by+cz \a,b,c){x,y,z\. 

a,b,c,x,y,zÇ:¥p 

For abelian groups G, the probability distributions obtained by Fourier sampling over G are independent of 
the actual coset of the hidden subgroup that arises on measuring the function value; however, they depend 
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of course on the hidden subgroup. But since now we are doing abelian Fourier sampling over a non-abelian 
group, we have to consider the effect of applying F to a coset of tAij, where t = (0, 0, r) and r G ¥ p . Note 
that tAij = {(M, f-ii, (2) i + M + T ) ■ A 4 & F p}- We obtain 

F\tAij) = \ ^ CT ( 2 w (o+«+tf-f)M+ci/* a I | ,6,c>. 

P a,6,ceF p \AteF p / 

Hence, the probability of observing a particular triple (o, 6, c) is p~ 4 \ Yl^w ü/ a+feí+CJ ~( Cí )/ 2 ) ít+clít2 1 2 . If 
c / 0, this is a quadratic Weil sum and we can use Fact ^ to conclude that the probability of observing 
(a,b,c) is given by p~ 3 , independent of The probability of observing (a, b, c), c 7^ is 1 — ~. If 
c = 0, only terms of the form (— ï», 6, 0) show up. These terms do give information about i; however, the 
probability of observing such a term is |. Thus, the forgetful abelian method gives exponentially small 
information about i. 



2.5 Efficient quantum circuits for the Fourier Transform on H p 

The fact that any QFT for any fïnite group is a unitary matrix (when properly normalized) makes this 
class of transformations an important source of transformations a quantum computer can carry out. The 
problem of finding efficient implementations of QFTs in terms of quantum circuits was studied previously, 
see ||H0y97| lBea97l IPRB99I IHRTS03I IMRR041. From IMRR04I Theorem 2] it follows that for any prime 



p the QFT for the Heisenberg group H p can by computed in polylog(p) operations. In the following we 
give an explicit description of an efficient quantum circuit which computes QFT Hp . First, note that we are 
interested in a realization on a quantum computer which works on qubits. This means that we have to embed 
the states and transformations into a register of size 2™ for some positive integer n. In the following we will 
assume that n is the smallest integer such that p < 2 n and we will identify the group elements (x,y,z) G TL P 
with a subset of the binary strings of length 3n: in each of the three components we choose the basis vectors 
|0), . . . , \p — 1} to represent the respective component of the element (x, y, z). The following proposition 
shows that a QFT for 7í p can be implemented efficiently in terms of elementary quantum gates. 

Proposition 1 Letpbe prime, let Tí p be the Heisenberg group oforderp 3 and let Irr(Hp) = {Xa,b '■ {a, b) G 
Fp} U {pk : k = 1, . . . ,p — 1} denote the irreducible representations ofTí p . Then the QFT for 7í p with 
respect to Irr(7í p ) can be computed using 0(log 3 p) elementary quantum gates. 

Proof: First we consider the normal subgroup iVoo < TL P and compute a Fourier transform for this abelian 
group. This group is isomorphic to a direct product of two cyclic groups, i. e., A^oo = Z p x Z p . The elements 
of iVoo are given by A^oo = {(0, y, z) : y, z G Z p }, i. e., we can identify the elements of iVoo with those 
binary strings of length 3n which have trivial support on the first n positions. Note that the irreducible 
representations of are given by V'a.fe for a, b G Z p , where 

^a )6 (0, y, z) := exp(27ri/p{ay + bz)) = üo^ +bz . 

Since ÍVqo is normal the group TC P operates on the irreducible representations [CR62 1. We denote this action 
by "*", i. e., we have a map * : TL P x Irr(7í p ) — * lrv(7í p ) which is explicitly given by (x, y, z) * i\) a ,b = 

V'ajfe— ax- 

Next, we choose as a transversal for < Tí p the ordered list T = [(x, 0, 0) : x G 7L p \. We have 
to be able to efficiently implement the images of all irreducible representations of TL P evaluated at the 
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elements of T. This is required for the so-called 'twiddle factors' in the decomposition of QFT W along 
the subgroup tower {1} < < Tí p . Indeed, we construct a QFT adapted to this subgroup tower, see 
also [PRB99, MRR04|. We now use the following formula for implementing a QFT G which holds in the 
situation where we have an abelian normal subgroup N and an abelian factor group G/N: 

QFT Wp = (1| G/JV | ® QF1V) (0*(í)) (QFT G/iV <g> l,^) . 

Here <ï> denotes an extension of the decomposition of the regular representation of ./V into irreducibles. 
Denoting this direct sum by A, i. e., A := © íer 3>(í), this means that we have to implement the following 
transformation: 

A • \x)\a)\b) i > i \ x )\ a )\ h ~ ax ) : 

A . \x)\a)\b) » ^ ^| x )|0)|6) : ifa = 0. 

It is straightforward to implement A using classical efficient circuits for modular addition and multiplica- 
tion. Hence A can be implemented using O(log 3 0)) quantum gates. Note that QFTjy = QFT Z ®QFT Z 
and QFT G / Noc = QFT Zp , both of which can be either implemented approximately [Kit95] or exactly 
[MZ04] on a quantum computer using 0(log 2 p) many elementary quantum gates. Hence the claimed com- 
plexity for computing a quantum Fourier transform for TL P follows. ■ 



3 Random bases and Fourier sampling 
3.1 Nearly orthogonal vectors 

In this subsection, we state some results about sets of nearly orthogonal unit vectors in a Hilbert space. We 
use ||·|| to denote the ^2-norm of vectors as well as the ^-induced operator norm of matrices. We use ||v||i 
to denote the ^-norm of a vector v. We let ||M|| tr = TtVM^M denote the trace norm of a matrix M. For 
subspaces Vi, V% having trivial intersection, their overlap is defined as ovlap(Vi, V2) = max^^^ |(wi|«2)|> 
where v-i range over unit vectors in Vi. Let II j denote the orthogonal projection operator onto V%. It is easy 
to see that ovlap(Ví, V2) = 1 1 üa IT2 1 1 - 

Proposition 2 Let Vi , V2 be subspaces of a Hilbert space having trivial intersection. Let ai denote the 
totally mixed state in Vi. Let V^ denote the orthogonal complement of Vi in V± + V2 and a' 2 denote the 
totally mixed state in V 2 '. Let 5 = ovlap(Vi, V2). Then, 

h2-<y' 2 \W<25 l l\l-5 2 )- 1 /\ 

Proof: Let d = dim Vz and ai, . . . , ad be an orthonormal basis for V2. Let a[, . . . , a' d be the Gram-Schmidt 
orthonormalisation of ai, . . . , ad with respect to V\. Hence, a\, . . . , a' d is an orthonormal basis for V 2 \ We 
will show that \\\ai)(ai\ - |a^)(^||| t r < 2<5 1 / 2 (1 - S 2 )" 1 ^ for all 1 < i < d. Since a 2 = \ Ef=i \<l·l)(fli\ 
and <j' 2 = \ J2ti kí)Kl» we wil1 get 

d 

\\<T2 ~ 4lkr < E Hl a *)^l " K>KHItr < ~ 
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Fix some i, 1 < i < d. Let fej + a denote the orthogonal projection of ai onto the space spanned by V\ 
and ai, ... , Qi-i, where òj G Ví and q G spanjai, . . . , Qj-i} Ç y 2 . Then, 



l>||&i + Cj|| 2 > \\b i \\ 2 + \\c i \\ 2 -2\{b i \c ll 



> ||6 l || 2 + || Cï || 2 -2 ( 5||6 l ||||c ï || 

= (l-<5 2 )||y 2 + (5116,11 -|MI) 2 

> (i-^INI 2 , 



i.e. H^H^.Now, 



Wh + cí\\ 2 = {ai\bi + Cj) = (aj|6j) + (aj|cj) = (aj|6j) < 



i. e. ||6j + Cj|| < í 1 / 2 (l — í 2 )^ 1 / 4 . The third equality above follows from the fact that oi, . . . , Oj_i, Oj are 
pairwise orthogonal. Now (aj|a^) = ||aj — òj — Cj|| = yj\ — \\bi + q|| 2 , and hence, 

|||oíX«í| - loíXaíllltr = 2^/l-|< 0i |a<)|2 = 2\\h + q|| < 25 l ' 2 {\ - í 2 )" 4 / 4 . 
This completes the proof of the proposition. ■ 

Proposition 3 Let v [ , . . . , v' n be unit vectors in a Hilbert space. Let < S < Suppose for all / j, 
\{ v i\ v j)\ < à. Let v±, . . . ,v n be unit vectors obtained by Gram-Schmidt orthonormalising v[, . . . , v' n . Then 
for any i, 1 < i < n, 

\\\ví)(ví\ - |^)(^||| t r < 2\/6- <5Vn- 

Proof: Fix some i, 1 < i < n. Let a.j + i = Yl)=i a j v j ^ e tne orthogonal projection of v' i+1 onto the 
subspace spanned by v^, . . . ,1^. Then for all k, 1 < k < i, (v' k \v' i+1 — Oj+i) = i.e. (i^K+i) = 
S}=i ^'(^fel^j)- Suppose fc, 1 < k < i is such that \a k \ = max j:1 <j<j |cKj-|. Then, 

5>lKK + i)| > KIK^tó)|- E KIK*4K>I 

j:l<j<i 

> Kl - E 1^11(41^)1 

3+k 

> \a k \(l-(i-l)S) 



i.e. maxj : i<j<j |aj| < 25. Now, 



lk+i|| 2 < $^|q!j| 2 ||«j|| 2 + E MMK^K') 



< A5 2 n + 45 3 n 2 

< A5 2 n + 2ó 2 n 
= 65 2 n. 
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Reasoning as at the end of the proof of Proposi tion|2j we get 



v i+x ){v i+1 \ - K+i)K 



j+lllltr — 



2^1-|<^ + iK + i}l 2 



2a/ 1 - IK+l 



2 V / 1-(1- ||a m || 2 ) 



2||aj+i 



< 



2V6 ■ 5y/n. 



This completes the proof of the proposition. 



3.2 Random orthonormal vectors 

In this subsection, we state some facts about random orthonormal sets of vectors in C d . One way of generat- 
ing a random unit vector in C d is as follows: Consider (7/1, ... , y2d) £ M. 2d , where each yi is independently 
chosen according to the one dimensional Gaussian distribution with mean and variance 1 (i. e. yi is a 



vector (x\, . . . , X2d), where Xi = . 2 Vi g= (note that any = with zero probability). We thus get a 

random unit vector in M. 2d . Identifying a pair of real numbers with a single complex number, we get a ran- 
dom unit vector (z\, . . . , z^) in C d . To generate a random orthonormal ordered set {v±, . . . , v m } of vectors 
in C d , we can first sample m unit vectors {v[, . . . , w^} in C d and then do Gram-Schmidt orthonormalisation 
on them to get {v±, . . . , v m } (note that with probability 1, {v[, . . . , v^} are linearly independent). 

The following fact can be proved by combining Theorem 14.3.2 and Proposition 14.3.3 of [Mat02 
Chapter 14] and using the concavity of the square-root function. 

Fact 2 Let t > 0, and \ v), \w) independent random unit vectors in C d . Then, 



We will require the following upper and lower bounds on the tails of the chi-square distribution (the 
chi-square distribution with d degrees of freedom is the sum of squares of d independent Gaussians with 
mean and variance 1). The upper bound can be proved via Chernoff-style arguments on the moment 
generating function of the chi-square distribution. The lower bound follows, for example, from the central 
limit theorem in probability theory. One can also give a direct proof of the lower bound using the probability 
density function of the chi-square distribution and estimating it via Stirling's approximation of the gamma 
function. 

Fact 3 Let (Xi, . . . , X<i) be independent random variables such that Xi is one-dimensional Gaussian with 
mean and variance 1. Let X 2 = X 2 + • • • + X3. Let < e < 1/2. There exists a universal constant 
7 > such that 



1. Pr[\X 2 -d\> de] < 2exp(-de 2 /6), 

2. Pr[X 2 > d + Vd] > 7, Pr[X 2 < d - Vd) > 7. 

The following result follows easily from Fact|5] A similar result appears as Lemma 2 in [MRRS04]. 




Pr \(v\w)\>t+— <2exp(-t 2 d). 
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Fact 4 Let V = {o 1 , . . . , a p } be a random orthonormal set of p vectors in C d . Let a*- denote the jth 
coordinate of vector a i . Define the d-dimensional probability vector S asfollows: Sj = ~ X/?=i l a j| 2 - Let 
< e < 1/2. Suppose p = f2(e~ 2 \ogd). Let U denote the uniform probability distribution on {1, . . . , d}. 
Then, with probability at least 1 — exp(— Í7(e 2 p)) over the choice ofV, \\S — U\\i < e. 

We will also need the following Chernoff upper bounds on the tail of the sum of d independent identically 
distributed binary random variables. 

Fact 5 (|AS00, Cor. A.7, Theorem A.13]) Let (X\, . . . , Xj) be independent binary random variables such 
that Vr[Xi = 1] = p. Let X = X x H h X d . Let < e < 1/2. nen, 

1. Pr [|f -p\ > e] < 2exp(-2e 2 d), 

2. Pr[X < f ] < exp(-dp/8). 



3.3 Hidden subgroup problem and Fourier sampling 

In this subsection, we recali the Standard approach to solving the hidden subgroup problem based on Fourier 
sampling. A (í-dimensional unitary representation of G is a group homomorphism p : G — > U(d), where 
U(<i) is the group of d X d complex unitary matrices under multiplication. Let C[G] denote the group 
àlgebra; it is a |G|-dimensional Hilbert space over C with group elements \g), g G G as an orthonormal 
basis. Let 1Z[G] denote the |G|-dimensional Hilbert space over C spanned by the orthonormal basis vectors 
\p,i,j), where p runs over inequi valent irreducible unitary representations of G and i,j run over the row 
and column indices of p. The quantum Fourier transform over G, QFT G , is the following C-linear map 
from C[G] to TZ[G] defined as follows: 

p V í,j=i 

where d p denotes the dimension of p. QFT G is an inner product preserving map from C[G] to TZ[G}. 

For a subset T Ç G, define \T) = Ylt^T I*) to ^ e tne un if° rm superposition over elements of 



T. For a representation p, define the matrix p(T) = ^= J2teT P(^)- ^ H < G, it can be shown (see 



/|T| 

e.g. [HRTS03D that J p(H) is an orthogonal projection onto the subspace VÍ of the representation 

space of p consisting of all vectors \v) such that p{h)\v) = \v) for all h 6 H. Thus, rank(p(fí)) = dim V^. 

In the strong Fourier sampling method for the hidden subgroup problem, we begin by forming the uni- 
form superposition -J= T. g eG !#) 1°) and then f to § et the superposition -J= T, g eG \a)\f(g))- We 
then measure the second register to get a uniform mixture over vectors \gH) in the first register. Assuming 
the first register is in state \gH) for some particular g G G, its state after the application of QFT G becomes 



V\ G W H \ o.i.i hGH 



p,i,j heH 

If we now measure the representation name and column index, we sample (p, j) with probability 

Pb(pJ) = ^YMsH)\ 2 = ^||p(^)|i)|| 2 = ^||p(íí)|í)|| 2 . 



12 



The third equality above follows from the fact that \\p(gH)\ j) \\ = \\p(g)p(H)\j}\\ = \\p(H)\j)\\, since 
p(g) is unitary. Thus, as long as we measure just the representation name and column index (p, j), the 
probabilities are independent of the actual coset gH that we íind ourselves in. This fact can be viewed as 
the non-abelian generalisation of the fact that in abelian Fourier sampling the probability distribution on the 
characters is independent of the actual coset that we land up in. Also, it can be shown that (see IGSVV 04D 

P§(P) = E^IIPWU)!! 2 = ^rank(p(ií)) = ^dimV>. 

In weak Fourier sampling, we only measure the names p of the representations and ignore the column indices 
j. It can be shown (see e.g. [HRTS03|) that for normal hidden subgroups H, no more information about 
H is contained in the column space of the resulting state after the measurement of p. Thus, weak Fourier 
sampling is the optimal measurement to recover a normal hidden subgroup starting from the uniform mixture 
of coset states. 

Define a distance measure w(G; H\, H 2 ) = Y1 P l-^Hi (p) ~ ^^(z 9 )! between subgroups Hi,H2 < G. 
w(G; H\ , H 2 ) is the total variation distance between the probability distributions, when the hidden subgroup 
is H\ or H2, on the names of the representations obtained via weak Fourier sampling. I HRTS Ü31 IGS VV041 
show that 0(log \ G\) weak Fourier samplings suffice to reconstruct the normal core c{H) of the hidden 
subgroup H, where c(H) is the largest normal subgroup of G contained in H. Adapting their arguments, 
we prové the following result. 

Proposition4 LetH 1 ,H 2 < G. Suppose c(H x ) / c(H 2 ). Then, w{G;H 1 ,H 2 ) > 1/2. 

Proof: Let N\ = c(H{) and N2 = c{H2). Without loss of generality, N\ ^ N2. Define the kernel of a 
representation ker p = {g € G : p(g) = 1^}; ker(p) < G. It can be shown (see e.g. [HRTS03|) for an 
irreducible representation p and a subgroup H < G, that if rank(p(iï)) > 0, c(H) < ker p. Hence, 

p P p:N2<kevp ' ' 

Since Ni < G, N X H 2 is a subgroup of G. Hence, Ni < c{NiH 2 ) and N 2 < c(NiH 2 ). Since N t ^ H 2 , 
IÍV1ÜZ2I > 2 • l^l- F° r an irreducible representation p such that Ni < ker p, 

rank(p(iV 1 F 2 )) = lank^Nx) p(H 2 )) = rank(p(H 2 )). 

Also, 

1= E ^|^·rank(p(iV 1 ff 2 ))>2. E ^ " rank(p(^ 2 )), 



1 .e. 



Finally, 



p:A r l,A r 2<lkerp ' ' 



W {G-H U H 2 ) = ^^-·|| J ff 1 |r a nk( /0 (F 1 ))-|F 2 |rank(p(F 2 ))| 
p ' ' 
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^ E igr ■ |H a | rank(p(fli,)) 

p:A r 2<kerp,Afi^l kcrp ' ' 

> 1- E i^i -1^21 rank(p(H 2 )) 

1 

> -. 

~ 2 

This completes the proof. ■ 
For a normal subgroup N <] G, define the normal core family of N, ncï(N) = {H : H < G, c(H) = 
N}. In view of PropositionlU the remaining challenge is to distinguish between subgroups H\,H2 from the 
same normal core family. 

The success of strong Fourier sampling depends on how much statistical information about H is present 
in the probability distribution P§(p,j). The amount of information, in general, depends on the choice of 
basis for each representation p, i. e., on the choice of basis for j; see [MRRS04] for more details. Grigni et 
al. IGSVV 04I show that under certain condi tions on G and H, the random strong Fourier sampling method, 
where a random choice of basis is made for each representation, gives exponentially small information about 
distinguishing H from the identity subgroup. In the next section, we prové a complementary result viz. 
under different conditions on G, (log | C| random strong Fourier samplings do give enough information 
to reconstruct the hidden subgroup H with high probability. 



4 Power of the random strong method 

In this section, we define a parameter r(G) on a group G which, if at least (log \G\)~ ^\ suffices for the 
random strong method to identify the hidden subgroup with (log IGI) ^) Fourier samplings. Let Hi,H 2 < 
G. We flrst define a distance measure r(G; H\, H2) between H\ : tÏ2. In what follows, we use the notation 
of Section 1331 

Definition 1 (r(G; H\ , H2; p)) Suppose p is an irreducible d p -dimensional unitary representation ofG. Let 
Hi denote the orthogonal projection onto V^. i. e. Ilj = r^r YlheH P(h)- Let Iíi ; 2 denote the orthogonal 
projection onto n V^. It is easy to check that n V£ 2 = V? H ^ where (H\, H2) denotes the 
subgroup of G generated by H\ and H2. Thus, Hi t 2 = vnj^H^\ Ylhe(Hi H 2 ) P^ 1 )- Define = üj — II12. 
H'i is the orthogonal projection onto the subspace V- defined as the orthogonal complement of V£ D V£ 2 
in Vft,. V{ and V 2 have trivial intersection. Define Vi = rank(IIj) and = rank(lï^). Define h = 

max{|iïi|ri, l^l^}» h = |(|iïi|ri — |i?2|^2)| and 5 = WH^H^W- Recali that 5 = ovlap(y i / , V 2 ). Consider 
the following three cases: 

1. When j^fer = íí((í"i + r2) 3 / 2 ). Loosely speaking, r±, r 2 are both small. In this case, define 
r{G;H 1 ,H 2 -p)=m^l~\ Q ( ¥LL + ^lA ] _ 2 8 l / 2 (l- 5^' } 1 




2. When ^\q\ = ^( r i) an d ^ = Q(log 2 \G\). Loosely speaking, r\ is small and r 2 is relatively large 
with respect to r%. In this case, define 

r(G; Hi,H 2 ; p) = max < — - 



2 \Vn 
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3. Otherwise, define r(G; Hi, H 2 ; p) = h. 

Definition 2 (r(G; H X ,H 2 ), r(G)) Let H 1 , H 2 < G. Define r(G; H U H 2 ) = E P ]g[ " #1, #2; p) and 

r(G) = mm HuH2 r(G; H 1 ,H 2 ). 

From the above definition, it is easy to see that r{G\ H\, H 2 ) > w(G; Hi, H 2 ). 

Definition 3 (P§ B ) Let B be a set of orthonormal bases for the irreducible unitary representations of G. 

Suppose H < G. P H ' denotes the probability distribution on the representation names and column indices 
(p,j) got by strong Fourier sampling the state \H) according to B. 

The significance of r(G; H\,H 2 ) arises from the following theorem. 

Theorem 1 With probability at least 1 — exp(— í2(log 2 |G|)) over the choice ofrandom representation bases 
Bfor Fourier sampling, 

\\P%f-P%fL·>r(G;H l ,H 2 ). 

Using this theorem, we can apply a 'minimum-finding-like' algorithm to identify the hidden subgroup. 

Corollary 1 Let s(G) denote the number of distinct subgroups of G. With probability at least 2/3 over 
the choice of random bases far representations of G, Fourier sampling O ( "pz^gj^ J tintes in a random 

basis gives enough classical Information to identify a hidden subgroup in G. In particular, O 
random strong Fourier samplings suffice. 

Proof: From Theorem ^ we get that for all pairs of subgroups H\,H 2 < G, with probability at least 

2 G 13 G 13 

1 — exp(— fi(log |G|)) over the choice of random bases B for representations of G, \\P H ^ — P H ' ||tr > 

G 13 G 13 

r(G). Call a set of representation bases B good if \\Pjj' — P H ' 2 ||tr > r {G) for all pairs of subgroups 
Hi,H2 < G. By the union bound on probabilities, a random choice of representation bases gives a good B 
with probability at least 1 — s(G) exp(— íl(log 2 |G|)) = 1 — exp(— í2(log 2 |G|)). Suppose we have such a 
good B. Under the promise that the hidden subgroup is either H\ or H 2 , B recognises which one it is with 
confidence at least 1/2 + r (G) / 4 using Bayes's rule. Using Fact|5l the confidence can be boosted to at least 

1 — 4g ( G ) by Fourier sampling O ( ^S^gp ) times with B. We can now run a classical 'minimum-finding- 
like' algorithm on the measured samples, comparing two subgroups H\ , H 2 < G at a time, to discover the 
actual hidden subgroup H in G with confidence at least 1 — £^§y = 3/4. The overall confidence bound 

becomes (1 - exp(-íí(log 2 \G\)))-\> |. The second bound follows from the fact that s(G) < 2 log2 \ G \, 
since any group of size a has at most log a generators. ■ 
The rest of the section is devoted to proving Theorem^ We first prové some necessary technical lemmas. 

Lemma 2 Let W = {a 1 , . . . , a p } U . . . , b q } U {c 1 , . . . , c r } be a random orthonormal set of p + q + r 
vectors in C d . Let a* denote the jth coordinate of vector a l ; similar notations will be usedfor the vectors 
b l , c 1 too. Define two d-dimensional probability vectors S, T as follows: 

\i=l 1=1 / \i=l 1=1 / 
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Then there exists 6 = 9((p + q + r) 3 / 2 ) such that the following holds: Define a = dd 2 — 2 log(p + q + r) 
Suppose a = Í2(l). Then, with probabüity at least 1 — exp(— $7(a)) over the choice ofW, 

\ S -T\\ í = ni^-+ ^ 



p + r q + r 

Proof: Generate a set W' = {a n , . . . , a' p } U {b n , . . . , b' q } U {c' 1 , . . . , c /r } of p + q + r random independent 
unit vectors in C d as described in Section EOl Let aj , d'-, 7^, j = {1, . . . , d} denote the Gaussians used to 
generate the random unit vectors a n , b n , c n respecti vely. Then, 

oi 1 b'ï y? 



J £?=iKT' J Etil/?fl 2 ' J Ef =1 l7ri 2 ' 

By Fact|3j with probabüity at least 1 — 2 exp(— dò 2 ) over the choice of the Gaussians, the normalisation 
factor in the denominator of a given vector in W' is y(l± e)d where e = 0(5). Let E'o be the event that 
the normalisation factors in the denominators of all vectors in W are ± e)d. By the union bound on 
probabilities, Eq occurs with probabüity at least 1 — 2 exp(— a) over the choice of the Gaussians. 

Since a = 0(1), S > ^. By FactEJ for any w H ,w' j G W',i ^ j, | | < 5 + ^ < 26 
with probabüity at least 1 — 2exp(— dS 2 ) over the choice of the Gaussians. Let E\ denote the event that 
\(w' l \w' J }\ < 25 for all w ll ,w^ G W 7 ', i / i- By the union bound on probabilities, E% occurs with 
probabüity at least 1 — 2 exp(— a) over the choice of the Gaussians. 

Using Fact|3]we see that for any fïxed coordinate j, with constant probabüity at least 9 over the choice 
of the Gaussians, each of the following three events occurs : 



Since these are independent events, all three of them hold at coordinate j simultaneously with constant 
probabüity at least 9 3 . Call such a coordinate j good. Let E2 denote the event that more than ^Ç- coordinates 
j are good. By Fact|5j E% occurs with probabüity at least 1 — exp(d# 3 /8) over the choice of the Gaussians. 

Now suppose that all three events Eq,E\, E2 occur. We Gram-Schmidt orthonormalise W' to get the 
random orthonormal set W = {a 1 , . . . , a p } U {b 1 , . . . , b q } U {c 1 , . . . , c r }. Let S', T' be the analogous 
probabüity vectors defined with respect to W' instead of W. From Proposi tion|3j we see that 

\\\w)(w\ - \w')(w'\\\tr < 20 • 6 ■ (p + q + r) = 0{(p + q + r)~ l ) 

for corresponding vectors w G W, w' G W. Define density matrices 



o - 

P + 



l - r ÍÉ i° 4 >< a< i + E i c ^ cï i) « = vr r { E io^i + E 1^" 

\i=l i=l / y \i=l i=l 



r^: E i + E \^\) . = ^r r f E + E i c ' l )( c '" 

\2 = 1 2 = 1 / 



=1 i=l 



Then, S,S',T,T' are the probabüity distributions got by measuring the states a,a',T,r' in the Standard 
basis of C d . By triangle inequality, \\a — o-'\\ tI = 0((p + q + r) _1 ) and \\t — r'||tr = 0((p + (7 + 
Hence, ||5 - 5'||i = 0((p + q + r)" 1 ) and \\T - T'\\\ = 0((p + q + r)" 1 ). 
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For a good coordinate j 
\S'-T'\ > -, S^,+ r + l f 1 I 



3 v 



(p + r)(l + e)d (q + r)(l — e)d (l + e)d\p + r q + r 



(p + r)(l + e)d (ç + r)(l-e)d 



(g + r)(l-e 2 )d (p + r)(q + r)(l + e)d (p + r)(l + e)d (q + r)(l-e)d 

«i 1 ... . \.uí\í . ^ 



(p + g + r) 1 / 2 (g + r)(l - 0((p + <? + r)~ 3 ))d J \d\p + r q + r 



d \p + r q + r 

The first, third and fourth steps above follow from the fact that e = 0(5) = 0((p + q + r)~ 3 / 2 ) and p < q 
without loss of generality. 



Now, 



\s'-T' h > V \s' j -T'\>^.n(U^ + ^))=n(^L + ^- 

' J J 2 \d\p + r q + rJJ \p + r q + r 

j:j gOOd 



Finally, 



|S-T||i > \\S' -T'Hi - \\S- S'Wx - llT-T'Hi 



p + r q + T) \p + q + r 



K P + r q + r 
The coníidence bound is 

Pr[£o AfíiAB 2 ]>l - 4exp(-a) - exp(d6 3 /8) = 1 - exp(-í2(a)), 

since 5 = 0(1). This completes the proof of the lemma. ■ 
We can prové the following lemma in a similar fashion as Lemma|2] 

Lemma 3 Let W = {a 1 , . . . , a p } be a random orthonormal set of p vectors in C d . Let a* denote the jth 
coordinate of vector a\ Define the d-dimensional probability vector S asfollows: Sj = - 2\2i=i \ a )\ 2 - Then 
there exists 5 = 0(p~ 1 ) such that the following holds: Define a = d5 2 — 21ogp. Suppose a = íí(l). Let U 
denote the uniform probability distribution on {1, . . . , d}. Then, with probability at least 1 — exp(— íí(a)) 
over the choice ofV, \\S-U\\ 1 = n(p-^ 2 ). 

Proof: (Sketch) Generate a set W 1 = {a n , . . . , a' p } of p random independent unit vectors in C d as described 
in Section ET2l Let a'j , j = {1, . . . ,d} denote the Gaussians used to generate the random unit vectors 

a . Then, a'- = =^ — 3 ,- 2 . We Gram-Schmidt orthonormalise W to get the random orthonormal set 

L·;=i \ a i I 

W = {a 1 , . . . , a p }. Let Eq be the event that the normalisation factors in the denominators of all vectors 
in W' are y(l± e)d, where e = 0(5). Eq occurs with probability at least 1 — 2exp(— a)) over the 
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choice of the Gaussians. Let E\ denote the event that | (w H \ w' J ') \ < 25 for all w' l ,w' 3 S W, i ^ j. E\ 
occurs with probability at least 1 — 2 exp(— a) over the choice of the Gaussians. Call a coordinate j good if 



Y^ï=x \ a 'j\ 2 > P + \fP- Let E2 denote the event that more than ^ coordinates j are good. E2 occurs with 
probability at least 1 — exp(d#/8) over the choice of the Gaussians. 

Now suppose that all three events Eq,E\, E2 occur. Let S' be the analogous probability vector defined 
with respect to W instead of W . Then, ||5 — S'||i = 0{p~ l l 2 ). For a good coordinate j 



1 



{l + e)d 
—e 



+ 



1 



+ 



1 



(l + e)d ^/p{l + e)d 



dy/P 



= n 

The third step above follows from the fact that e 

115' - U\ 



1 



dy/p 
0(6) 



0(p~ 



Hence, 



> 



E 

3:3 good 



Ul>i- 



1 



d^/p 



.Vp 



Finally, 

||5-C/||i> 
The confidence bound is 



\S' - U\\i - \\S - S'W! = vt{p- 1/2 ) - oip- 1 ) = vl{ p - 1/2 ). 



¥ï[E A Et A E 2 ) > 1 - 4exp(-a) - exp(d0/8) = 1 - exp(-íí(a)), 

since 5 = O(l). This completes the proof of the lemma. ■ 

We are now in a position to finally prové Theorem[n 
Proof: (of Theorem [0 Let p be an irreducible d p -dimensional unitary representation of G. We follow 
the notation of Definition for p. Let V 2 n denote the orthogonal complement of V[ in V[ + V^. Let ai 
denote the totally mixed state in Vi and a'í denote the totally mixed state in V 2 n + (V\ fi V2). By Proposi- 



G,B P 



tion|5J ||cJ2 — o~2 ||tr < 2<5 1 / 2 (1 — 5 2 )~ 1 / 4 . Let B p be a random orthonormal basis for p. Let Pi .— ± H _ 
denote the probability distributions on the vectors of B p got by Fourier sampling the states \Hi) respec- 
tively, conditioned on p being observed. Then Pi is the probability distribution got by measuring crj in 
the basis B p . Let P% denote the probability distribution got by measuring a 2 in the basis B p . Then, 
\\ p 2 ~ P2W1 < 2í 1/2 (l - 5 2 ) -1/4 . Define n, 2 = rank(ni )2 ). Notethat r i = r' i + r x>2 . 

Suppose case 1 of Definitionfflapplies. Let W be a random orthonormal set of r[ + r' 2 + ri 2 vectors 
in C dp . Define probability distributions S, T with respect to W as in Lemma[2] By symmetry, P\ = S and 
P' 2 ' = T. Note that r[ + r 2 + n j2 < ri + r 2 and r' x + r' 2 + r 1<2 < d p < \f\G\- Hence, d p ■ 6»((rí + r 2 + 
ri )2 ) -3 ) — 21og(r' 1 + r' 2 + ri j2 ) = í^(log 2 |G|). The conditions of Lemma|2lare satisfied, and we get, with 

exp(-íl(log 2 |G|)) over the choice of B p , that ||Pi 
exp(— 0(log 2 |G|)) over the choice of B p , 



probability at least 1 
Thus with probability at least 1 



P"\ 



n 



n 



+ 



T'Z 



\Pl-P2\\l > \\Pl-P2 



2 lli 



|P 2 -P^'||l>íí 



+ 



r-2 



25 l l 2 (l-5 2 y 



1/4 



18 



Suppose case 2 of Definition ^ applies. Let W be a random orthonormal set of T\ vectors in C dp . 
Denne probability distribution S with respect to W as in Lemma|3] By symmetry, P\ = S. Note that 
i'l < d p < \/\G\. Hence, d p -8(r^ 2 ) — 21ogri = f2(log 2 |G|). The conditions of Lemma|3]are satisfied, and 

we get, with probability at least 1 — exp(— $7(log 2 \G\)) over the choice of B p , that \\Pi — U\\i = íí ("^f) ■ 

Also, r 2 = Q(rilogdp). The conditions of Fact|4]are satisfied, and we get, with probability at least 

1 — exp(— í7(log 2 |G|)) over the choice of B p , that ||Pa — U\\i = O (rjp=) ■ Thus with probability at least 

1 — exp(— S7(log 2 \G\)) over the choice of B p , 



IIP - P2W1 > \\Pi - u\\x - \\p 2 - u\\t = n 

Suppose |iïi|ri > \H2\r2 i. e. h = \H\\r\. Then, 



1 



Ikhi _í íí 2 lli - Z> WPhMjP^ - Ph 2 {p)p H2 lli -Z^ïgi ' ll- tíirii H 1 - u ^ f h 2 lli- 

P P 1 1 

Now, 

\\H iri P^f p -H 2 r 2 pSf p \\i = \\H 1 r 1 (P^f''-PSf p ) + (Hirx-H 2 r 2 )P^\\ 1 

-> Hiri II p G ' B p _ p g > b p\\ 

The last step above follows from the facts H\T\ — H 2 r 2 > 0, > ||u+||i where := u» if «; > 0, 

:= otherwise, and ||Pi — P2II1 = 2||(Pi — -F*2 ) + 1 1 1 f° r probability vectors Pi, P 2 . Also note that 

G 3 G S 

for any choice of representation bases B, \\HiriP H ' p — H 2 r 2 P H ^ p ||i > \H\r\ — H 2 r 2 \. Hence, 

,,pG,B pGJBn d P rr, QY í Hin \\P G ' B " P G > B p\\ irr- rr „ | \ 

iKiÍ! --Tffa II 1 - Z^j^l ' max |^ — ' H-^i ~ F H 2 lli. l-nm - #2r 2 | j 

^ E^( G ^i'^;p) 

p ' ' 
= r{G;H u H 2 ). 

For each representation p, the coníidence bound in applying the above random basis arguments is at 
least 1 -exp(-0(log 2 |G|)). Since there are at most |G| representations, the total confidence bound is at 
least 1 - \G\ exp(-0(log 2 \G\)) = 1 - exp(-íl(log 2 \G\)). This completes the proof of the theorem. ■ 

We now have all the tools to prové that r(7í p ) = 0(1). In fact, we can now prové the following theorem. 



Theorem 2 The random strong method is sufficient to solve the hidden subgroup problem in the Heisenberg 
group Tip. The query complexity of this algorithm is 0(\ogp). The quantum part of the algorithm consists 
of a circuit of size O (log 4 p) followed by a circuit of size 0{p 2 ) for implementing the measurement in a 
random orthonormal basis. The classical post-processing does not make any queries and has a running 
time of Ó(p 4 ). 

Proof: First, we characterize the normal core families in the Heisenberg group. We have that 

ncí(H p ) = {H p }, ncf(C(Hp)) = {C(^ P )}, ncf(^) = {Ni}, for i G {0, ... ,p - 1, 00} 
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are famílies of size 1 each. For the trivial group we get that 



ncf({l}) ={Aíj :»€ {0, . . . ,p - 1, oo}, j E {0, . . . ,p - 1}} U {{1}}. 

If Hi and H 2 are candidate hidden subgroups from different normal core families, then by Proposition |4] 
we get that r(7í p ; H\,H 2 ) > wÇH p ; H%, H 2 ) > 1/2. We now consider the situation where both H\,H 2 E 
ncf ({1}). We fix an irreducible representation p = Pk (for k = 1, . . . ,p — 1) of degree deg p = p. Now, we 
distinguish two cases: 

1. = \H2\ = p, i. e., there are i, j, i', f , 7^ such that l·L\ = Aíj and H 2 = A41 ai. 

Using the notation of Definition^we have that r\ = r 2 = 1, since by Lemma^the ranks of P^-i j an d 
Pk;i',j' are both one. Also, \\Pk;i,jPk;i',j' II < This also implies that r[ = n = 1 and r 2 = r2 = 1, 
since the one-dimensional projectors Pk,i,j, Pk;i',j' are linearly independent. Hence, P^j = Pk;i,j 

and -Pfc.j'j/ = Pfcii'j'- So, 6 = ll-Pfc^i^i'J'H - TZp- Since l-^il r i = = P, h = p and h = 0. 

As 



log |7íp| 31ogp 
we are in the first case of DefinitionHand obtain that 



rÇHp', Hi, H2; p) = f • (í2(l) - 2(p- l)- 1 /^ = í?(p). 

2. = p and I-E/2I = 1» i- £■> we have to distinguish H\ = A4J from the trivial subgroup H 2 = {1}. 
In this case n = 1 and r2 = rank(p({l})) = p which implies that h = p, h = 0. Since 



- íí(ri) and — = p = iï(log 2 \TLp\j, 



log \H P \ " n 
we are in the second case of Definition^and obtain that 



r(n p ;H 1 ,H 2 ;p) = ^-n(l) = ü{p). 



Overall we obtain that for H\,H 2 E ncf({l}), 



r(H p ; H l ,H 2 ) = Y,%- r(H p ; H x ,H 2 ;p) > £ . r (H p ; E X ,H 2 ; Pk ) > ÍP ■ Í2(p) = 0(1). 
P P k=l P P 

Hence, r(7í p ) = 0(1). Recali that s{TL p ) = 0(p 2 ). Now Corollary [Qshows that with probability at least 
2/3 over the choice of random representation bases, the HSP for TL P can be solved using O(logp) random 
strong Fourier samplings. 

As shown in Proposition^ the QFT over 7i p can be implemented using 0(log 3 p) elementary quantum 
gates. Since there are Oilogp) Fourier samplings, the initial part of the quantum circuit has size 0(log 4 p). 
The claimed statements about the number of quantum operations necessary to implement a measurement 
in a random orthonormal basis follow from general upper bounds of 0(p 2 ) on the number of gates in 
a factorization of a unitary operation U E U(p) into elementary gates. The classical time to generate 
the random U is 0(p 3 ) since we can start with a set of p random unit vectors and apply Gram-Schmidt 
orthonormalisation to obtain a random unitary matrix. For the classical post-processing we have to compute 
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a table of probability distributions with respect to the random measurement bases for all subgroups. Since 
there are 0(p 2 ) subgroups and each probability distribution computation takes time 0(p 2 ) we can upper 
bound this by 0{p A ). After this table has been precomputed the actual algorithm to rind the hidden subgroup 
is 'minimum-finding-like' in which we 'compare' two subgroups at a time. This takes time 0(p 2 ). Overall, 
we obtain that the running time of the classical part of this algorithm can be upper bounded by Ò(p 4 ). ■ 
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